# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1499 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1500 --- ## [Elastic node js client point in time syntax](https://discuss.elastic.co/t/elastic-node-js-client-point-in-time-syntax/267903)
**Author:** [@111452](https://discuss.elastic.co/u/111452)\ **Replies:** 0\ **Last updated:** [March 21, 2021, 10:13am UTC](https://discuss.elastic.co/t/elastic-node-js-client-point-in-time-syntax/267903 "2021-03-21T10:13:58Z")
Can someone show me the right syntax for using point in time in elastic search on node js client. I'm trying like this: const body = { query: { geo\_shape: { geometry: { relation: 'wit… --- ## [Create Custom Visualization for Kibana](https://discuss.elastic.co/t/create-custom-visualization-for-kibana/267837)
**Author:** [@mastersmit](https://discuss.elastic.co/u/mastersmit)\ **Replies:** 10\ **Last updated:** [March 21, 2021, 9:51am UTC](https://discuss.elastic.co/t/create-custom-visualization-for-kibana/267837 "2021-03-21T09:51:29Z")
I have a requirement to create a visualisation that replicates one of the legacy system. In the below screenshot it shows the expected and what i have so far... I could create a frontend, but was hoping if there is a w… --- ## [Data stream](https://discuss.elastic.co/t/data-stream/267901)
**Author:** [@dziri63](https://discuss.elastic.co/u/dziri63)\ **Replies:** 0\ **Last updated:** [March 21, 2021, 9:31am UTC](https://discuss.elastic.co/t/data-stream/267901 "2021-03-21T09:31:35Z")
Hello Can I use data stream indices without fleet ? For example i have a tcp input on a port ( logstash or filebeat doesnt matter) i want index it in a datastream index how can i do that ? thanks in advance --- ## [Using Nest, queries returning with 0 hits](https://discuss.elastic.co/t/using-nest-queries-returning-with-0-hits/267037)
**Author:** [@asimsek99](https://discuss.elastic.co/u/asimsek99)\ **Replies:** 4\ **Last updated:** [March 21, 2021, 9:22am UTC](https://discuss.elastic.co/t/using-nest-queries-returning-with-0-hits/267037 "2021-03-21T09:22:30Z")
Hey hey, Env: .net Core, Nest, Elasticsearch I had my queries running with using Logstash and Elastic with AWS. Decided to not use logstash and move to cloud.elastic.co. Trying to migrate the current queries to cloud.… --- ## [Unable to parse TIMESTAMP\_ISO8601 timestamp in logstash conf](https://discuss.elastic.co/t/unable-to-parse-timestamp-iso8601-timestamp-in-logstash-conf/267886)
**Author:** [@Micheal25](https://discuss.elastic.co/u/Micheal25)\ **Replies:** 2\ **Last updated:** [March 20, 2021, 7:52pm UTC](https://discuss.elastic.co/t/unable-to-parse-timestamp-iso8601-timestamp-in-logstash-conf/267886 "2021-03-20T19:52:59Z")
Hi Team, I am having parsing the "TIMESTAMP\_ISO8601" in logstash grok. The only differnce i see in the log message is extra space after the hours : in timestamp Eg: 2021-03-21T13:(\\s) 01:54.402+0000 this is occuring … --- ## [Multiline and csv filter](https://discuss.elastic.co/t/multiline-and-csv-filter/267888)
**Author:** [@vincedt09](https://discuss.elastic.co/u/vincedt09)\ **Replies:** 0\ **Last updated:** [March 20, 2021, 1:54pm UTC](https://discuss.elastic.co/t/multiline-and-csv-filter/267888 "2021-03-20T13:54:53Z")
Hi! I want to visualize in kibana map geo points with specific information(ex: latitude, longitude) csv { separator =\> "," skip\_empty\_rows =\> true columns =\> \[ "latitude","longitude" \] }… --- ## [Support matrix: luberjack plugin](https://discuss.elastic.co/t/support-matrix-luberjack-plugin/267875)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 4:25pm UTC](https://discuss.elastic.co/t/support-matrix-luberjack-plugin/267875 "2021-03-20T16:25:47Z")
Dear elasic colleagues, what I do not understand: You provide a support matrix for the logstash plugins In this matrix I do not find the lumberjack output plugin. This means for me: this plugin is not supported anym… --- ## [Logstash does not read rewritable csv file well](https://discuss.elastic.co/t/logstash-does-not-read-rewritable-csv-file-well/267880)
**Author:** [@Andrew\_Foxis](https://discuss.elastic.co/u/Andrew_Foxis)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 4:20pm UTC](https://discuss.elastic.co/t/logstash-does-not-read-rewritable-csv-file-well/267880 "2021-03-20T16:20:59Z")
Hi all. I have csv file: addr;peer;port;name;datetime (headers) 172.12.10.1; 34.15.67.43; 1123; peter; 2021-03-15 00:02:34 ( value rows (100-200 rows)) This file rewritable every 5 minutes. I want to get the full con… --- ## [Parse JSON in "message" field](https://discuss.elastic.co/t/parse-json-in-message-field/267854)
**Author:** [@surprised\_ferret](https://discuss.elastic.co/u/surprised_ferret)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 2:18pm UTC](https://discuss.elastic.co/t/parse-json-in-message-field/267854 "2021-03-20T14:18:42Z")
Elastic version 7.11.1 How do I parse a JSON structure (nested, one field has an array) out into separate fields of their own? I'm running filebeat on my k8 instance, this is what my "filebeat.yml" value looks like, i… --- ## [Anonymous access on iframe but sign in otherwise](https://discuss.elastic.co/t/anonymous-access-on-iframe-but-sign-in-otherwise/267724)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 2\ **Last updated:** [March 20, 2021, 2:15pm UTC](https://discuss.elastic.co/t/anonymous-access-on-iframe-but-sign-in-otherwise/267724 "2021-03-20T14:15:43Z")
I am creating a web app that has kibana iframes embedded that I would like to not require sign in for them. I have read all of the elastic forums and githubs but I still can't figure out how to allow this. When I use th… --- ## [Performance implications for elasticsearch when specifying fields that won't be in the indexed documents?](https://discuss.elastic.co/t/performance-implications-for-elasticsearch-when-specifying-fields-that-wont-be-in-the-indexed-documents/267858)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 8:18pm UTC](https://discuss.elastic.co/t/performance-implications-for-elasticsearch-when-specifying-fields-that-wont-be-in-the-indexed-documents/267858 "2021-03-19T20:18:03Z")
I'm working on switching to using the ECS toolchain for our indices (mostly logs). The usage notes for the generator say: If your indices will never populate particular ECS fields, there's no need to include those fie… --- ## [Filebeat 7.10 fails to collect events from multiple kubernetes pods](https://discuss.elastic.co/t/filebeat-7-10-fails-to-collect-events-from-multiple-kubernetes-pods/267406)
**Author:** [@bhavaniprasad\_reddy](https://discuss.elastic.co/u/bhavaniprasad_reddy)\ **Replies:** 6\ **Last updated:** [March 20, 2021, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-7-10-fails-to-collect-events-from-multiple-kubernetes-pods/267406 "2021-03-20T13:31:55Z")
Filebeat is configured to collect events from multiple kubernetes pods using or condition. Events from a specific pod are continuously collected but events from another pod are collected very slowly and no events are col… --- ## [Filter with scripted field](https://discuss.elastic.co/t/filter-with-scripted-field/267673)
**Author:** [@Mahibul](https://discuss.elastic.co/u/Mahibul)\ **Replies:** 2\ **Last updated:** [March 20, 2021, 12:58pm UTC](https://discuss.elastic.co/t/filter-with-scripted-field/267673 "2021-03-20T12:58:29Z")
Hi, I have created a scripted field test and the script is if (params\['\_source'\]\['additional'\] == null) { return -1 } return params\['\_source'\]\['additional'\].length() The type of the field is number. This works fin… --- ## [Index settings in logstash pipeline](https://discuss.elastic.co/t/index-settings-in-logstash-pipeline/267882)
**Author:** [@Automation\_Scripts](https://discuss.elastic.co/u/Automation_Scripts)\ **Replies:** 0\ **Last updated:** [March 20, 2021, 11:01am UTC](https://discuss.elastic.co/t/index-settings-in-logstash-pipeline/267882 "2021-03-20T11:01:13Z")
Hi guys, I have a logstash pipeline and i want to be able to set the number of replicas to 0 directly from my logstash.conf file. How can I do this? I have seen some docs with template, but is not working. The one from … --- ## [Voice alarm when fire a watch](https://discuss.elastic.co/t/voice-alarm-when-fire-a-watch/267855)
**Author:** [@lstoneir](https://discuss.elastic.co/u/lstoneir)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 7:23am UTC](https://discuss.elastic.co/t/voice-alarm-when-fire-a-watch/267855 "2021-03-20T07:23:16Z")
Hi, is there any way to play a voice or sound when firing a watch in kibana 7.10 ? --- ## [How to delete a data node](https://discuss.elastic.co/t/how-to-delete-a-data-node/267511)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [March 20, 2021, 6:46am UTC](https://discuss.elastic.co/t/how-to-delete-a-data-node/267511 "2021-03-20T06:46:03Z")
Hi there, I would like to delete one of many data nodes in production. There is stille plenty of space and the data node has only this role. Life can be so simple: stop the service and delte the machine. Is this all,… --- ## [Metric Beat AWS Billing](https://discuss.elastic.co/t/metric-beat-aws-billing/265654)
**Author:** [@vinay9](https://discuss.elastic.co/u/vinay9)\ **Replies:** 2\ **Last updated:** [March 20, 2021, 5:18am UTC](https://discuss.elastic.co/t/metric-beat-aws-billing/265654 "2021-03-20T05:18:19Z")
Any help on this is appreciated, I am using metricbeat to get the data from aws cloud watch and cost explorer, from Elasticsearch and to kibana dashboard i was able successfully get the all metrics for ec2 from aws. But … --- ## [Packetbeat will not GET Kibana HTTPS](https://discuss.elastic.co/t/packetbeat-will-not-get-kibana-https/267210)
**Author:** [@Elks2020](https://discuss.elastic.co/u/Elks2020)\ **Replies:** 6\ **Last updated:** [March 20, 2021, 4:09am UTC](https://discuss.elastic.co/t/packetbeat-will-not-get-kibana-https/267210 "2021-03-20T04:09:35Z")
Hello everyone, I need help to figure-out the following problem to be fixed where the packetbeat won't start! :tired\_face: ' ' ' packetbeat\[523584\]: Exiting: error connecting to Kibana: fail to get the Kibana version… --- ## [Alerts don't fire](https://discuss.elastic.co/t/alerts-dont-fire/267174)
**Author:** [@ShadwDrgn](https://discuss.elastic.co/u/ShadwDrgn)\ **Replies:** 11\ **Last updated:** [March 19, 2021, 11:41pm UTC](https://discuss.elastic.co/t/alerts-dont-fire/267174 "2021-03-19T23:41:21Z")
I feel like the attached image should not be possible since it's checking every minute and CLEARLY should be active, but is in an okay state? Alerts only become active one time for me... Once they recover, they seem to n… --- ## [Logstash new install: response code '403' contacting Elasticsearch](https://discuss.elastic.co/t/logstash-new-install-response-code-403-contacting-elasticsearch/267862)
**Author:** [@kmp](https://discuss.elastic.co/u/kmp)\ **Replies:** 0\ **Last updated:** [March 19, 2021, 8:45pm UTC](https://discuss.elastic.co/t/logstash-new-install-response-code-403-contacting-elasticsearch/267862 "2021-03-19T20:45:20Z")
Posting this for the record, should anyone else run into the same problem... LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError: Got response code '403' contacting Elasticsearch at URL 'https://es0… --- ## [Kibana shows empty pages](https://discuss.elastic.co/t/kibana-shows-empty-pages/267848)
**Author:** [@iatalay](https://discuss.elastic.co/u/iatalay)\ **Replies:** 1\ **Last updated:** [March 19, 2021, 8:30pm UTC](https://discuss.elastic.co/t/kibana-shows-empty-pages/267848 "2021-03-19T20:30:47Z")
Hi We have install Elasticsearch and Kibana 7.11.1 on RHEL 8.3. (Also I tried RHEL 7.9 for Kibana). We also have installed search-guard plugin. Some of the pages on Kibana are empty, show nothing. Tried firefox, chro… --- ## [How to set up a highly available elasticsearch cluster locally?](https://discuss.elastic.co/t/how-to-set-up-a-highly-available-elasticsearch-cluster-locally/267803)
**Author:** [@Belgacem\_Ghiloufi](https://discuss.elastic.co/u/Belgacem_Ghiloufi)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 8:05pm UTC](https://discuss.elastic.co/t/how-to-set-up-a-highly-available-elasticsearch-cluster-locally/267803 "2021-03-19T20:05:13Z")
I am new to Elasticsearch and I want to set up a highly available Elasticsearch cluster on one machine to test and learn how to use Elasticsearch. I hope that when the master node fails, one of the other nodes will take … --- ## [Managed index templates, composition, and ECS](https://discuss.elastic.co/t/managed-index-templates-composition-and-ecs/266734)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 3\ **Last updated:** [March 19, 2021, 8:04pm UTC](https://discuss.elastic.co/t/managed-index-templates-composition-and-ecs/266734 "2021-03-19T20:04:40Z")
We are upgrading to Elastic 7 and at the same time attempting to move our entire pipeline to ECS. I'm wondering how template composition fits in with everything. We primarily store transient logs and I'm wondering what … --- ## [Index mapping changed from object to nested and reindex](https://discuss.elastic.co/t/index-mapping-changed-from-object-to-nested-and-reindex/266373)
**Author:** [@Clony](https://discuss.elastic.co/u/Clony)\ **Replies:** 1\ **Last updated:** [March 19, 2021, 5:26pm UTC](https://discuss.elastic.co/t/index-mapping-changed-from-object-to-nested-and-reindex/266373 "2021-03-19T17:26:04Z")
Hello I want to change an index property which is object (default) to nested type and keep the data. The process I'm following is creating a new index with the new mappings then use the reindex API. The problem comes wh… --- ## [Visualization- ASA Flows by Network Bytes not showing in GB or MB](https://discuss.elastic.co/t/visualization-asa-flows-by-network-bytes-not-showing-in-gb-or-mb/267825)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 5:20pm UTC](https://discuss.elastic.co/t/visualization-asa-flows-by-network-bytes-not-showing-in-gb-or-mb/267825 "2021-03-19T17:20:38Z")
Hi Team, I would like to know how i can have the below graph show the GB/MB in the Y-Axis. Now its showing as Just the number , i need to change it to show as eg 1GB or 2GB etc. Please help Thanks, Ajesh --- ## [Kibana : internal server error](https://discuss.elastic.co/t/kibana-internal-server-error/267790)
**Author:** [@Salvatore\_Minervini](https://discuss.elastic.co/u/Salvatore_Minervini)\ **Replies:** 1\ **Last updated:** [March 19, 2021, 4:07pm UTC](https://discuss.elastic.co/t/kibana-internal-server-error/267790 "2021-03-19T16:07:32Z")
hi all, I'm new on kubernates and ELK and "i beg your pardon" if i wil lask something stupid, i googled a while for a solution but i found nothing so i decide to ask help.... in our configuration on kubernates, we hav… --- ## [\_index field filter performance VS index name in url](https://discuss.elastic.co/t/index-field-filter-performance-vs-index-name-in-url/266572)
**Author:** [@Abbass](https://discuss.elastic.co/u/Abbass)\ **Replies:** 4\ **Last updated:** [March 19, 2021, 3:33pm UTC](https://discuss.elastic.co/t/index-field-filter-performance-vs-index-name-in-url/266572 "2021-03-19T15:33:18Z")
From performance perspective, does filtering on \_index field behave as if i've set the index name in the URL? GET log-\*/\_doc/\_search { "query": { "bool": { "must": \[ { "term": { … --- ## [Logstash CSV adding multiple rows by splitting a column value](https://discuss.elastic.co/t/logstash-csv-adding-multiple-rows-by-splitting-a-column-value/267766)
**Author:** [@venkat\_s](https://discuss.elastic.co/u/venkat_s)\ **Replies:** 2\ **Last updated:** [March 19, 2021, 3:22pm UTC](https://discuss.elastic.co/t/logstash-csv-adding-multiple-rows-by-splitting-a-column-value/267766 "2021-03-19T15:22:54Z")
Hello, I am importing csv file to elasticsearch using logstash. I need to duplicate a row based on a comma separated column values. This is how the data looks. I want to add multiple rows based on the number of valu… --- ## ["No Added Sugar" and "Added Sugar" term match](https://discuss.elastic.co/t/no-added-sugar-and-added-sugar-term-match/267730)
**Author:** [@Alan88](https://discuss.elastic.co/u/Alan88)\ **Replies:** 3\ **Last updated:** [March 19, 2021, 3:17pm UTC](https://discuss.elastic.co/t/no-added-sugar-and-added-sugar-term-match/267730 "2021-03-19T15:17:01Z")
I'm looking for a way to tell elasticsearch that "no added sugar" and "added sugar" are separate phrases and should be indexed accordingly. I do not want them to conflate or conflict with each other. Docs example: "Col… --- ## [How to Get a Raw Logs Copy from elasticsearch](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326)
**Author:** [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Replies:** 6\ **Last updated:** [March 19, 2021, 3:11pm UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326 "2021-03-19T15:11:42Z")
Hi Team, We are currently sending all our audit logs to elasticsearch cluster using filebeat and auditbeat ( Logstash is not used) , Can we get the raw copy of logs or some log forwarder can be used in elasticsearch to … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1498) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1500)